Problem: CentralAuthUser calls DatabaseBlock::insert, passing a DB connection to another wiki. The User instance inside DatabaseBlock does not know about that DB, and may load data from the local DB, causing confusion. This was the root cause of T260485, which has a workaround in place.
Solution: DatabaseBlock and AbstractBlock should always use a string as the target and a UserIdentity (or Authority?) as the blocker. They should never create User instances.